Web Tether 1.0.0-pre.2

Changes in this release

• Addressed a security issue in the credentials-based authentication flow.
• Enforce more rigorous permission checks during execution to reduce the chance of unauthorized operations.
• Use unprivileged user in docker container

Full Changelog: v1.0.0-pre.1...v1.0.0-pre.2

Web Tether 1.0.0-pre.1

First public release.

Web Tether is a CLI that tunnels arbitrary TCP traffic over a single outbound WebSocket connection to a self-hosted relay.
Clients never listen for inbound connections and never talk to each other directly: each one dials out to the relay, which authenticates it, enforces its permissions, and bridges the streams.
A client binds a local TCP endpoint under a service name; another client connects a local listener to that name.

Features

• Relay — web-tether relay, WebSocket server (default 0.0.0.0:3000, --host / --port), service registry and per-connection routing between authorized clients.
• Raw TCP forwarding
  • --socket-bind <service>@<host>:<port> — register a service, forward inbound relay connections to a local endpoint.
  • --socket-connect <host>:<port>@<service> — open a local listener forwarding to a remote service.
• SOCKS4/5 proxy (CONNECT only, no UDP associate / bind)
  • --proxy-bind — resolve and dial SOCKS requests arriving from the relay.
  • --proxy-connect-static — local SOCKS proxy pinned to one remote service.
  • --proxy-connect-dynamic — local SOCKS proxy, per-destination routing from a hot-reloadable mapping file.
• Authentication — ECDH key pairs (generate-identity, identity:<pubkey>) or salted PBKDF2-SHA512 credentials (generate-credentials, credentials:<id>:<salt>|<hash>). Credentials work with a relay started without --identity.
• Authorization — per-client <action>|<service-pattern> rules (bind / connect, * wildcards) in a YAML/JSON clients file, watched and reloaded without restarting the relay. Deny by default.
• Transport encryption — every WebSocket frame is AES-GCM encrypted with a per-session key negotiated during the authentication handshake.
• Distribution — dependency-free single binary for Linux/macOS/Windows on amd64 and aarch64, plus multi-arch (linux/amd64, linux/arm64) images on ghcr.io/menecats/web-tether.

Out of scope: virtual network interfaces / mesh routing, UDP, and external identity providers.

Install

Prebuilt binaries web-tether_1.0.0-pre.1_<os>_<arch> are attached below, or:

docker pull ghcr.io/menecats/web-tether:1.0.0-pre.1

Quickstart

# identities: one for the relay, one per client
web-tether generate-identity --identity-file relay-identity
web-tether generate-identity --identity-file client-a-identity
web-tether generate-identity --identity-file client-b-identity

# clients.yml
version: 1
clients:
  - alias: client-a
    auth: identity:<contents-of-client-a-identity.pub>
    permissions: ["bind|remote-ssh"]
  - alias: client-b
    auth: identity:<contents-of-client-b-identity.pub>
    permissions: ["connect|remote-ssh"]

web-tether relay --clients clients.yml --identity relay-identity

# provider: expose the local SSH server as "remote-ssh"
web-tether connect --auth-identity-private-key client-a-identity \
    --auth-identity-relay-public-key relay-identity.pub \
    --socket-bind remote-ssh@127.0.0.1:22 ws://localhost:3000/relay

# consumer: local 1022 -> remote-ssh
web-tether connect --auth-identity-private-key client-b-identity \
    --auth-identity-relay-public-key relay-identity.pub \
    --socket-connect 0.0.0.0:1022@remote-ssh ws://localhost:3000/relay

ssh -p 1022 user@localhost

Expose a public relay behind a TLS-terminating reverse proxy and use wss://.

CLI reference, clients.yml schema, architecture and wire protocol: docs/.
Bug reports and feedback: issues. Licensed under AGPL-3.0.

---

Note: these release notes were drafted with the help of an AI writing assistant.